3 commits

Author	SHA1	Message	Date
mrwulf	9da0902640	pasta field WIP: add/const/reduce/mul spec drafts + memory-lean discharge ... AddSpec: sub_spec preconditions discharged by exact matches (the blanket simp[*] discharge here is what OOM-crashed the session — see formal-verification-control/POSTMORTEM-2026-07-02.md). ConstSpecs: R/R2/INV/ zero/one literal specs. ReduceSpec: full HAC 14.32 Montgomery accounting — per-round dropped-limb-is-zero facts from k = r·INV, exact t'·2^256 = t + m·p identity, composition with the general sub_spec reduction. MulSpec: 16-mac schoolbook accounting via zify + linear_combination (nonlinear cross-products are atoms), composed with montgomery_reduce_spec. DRAFTS: written against the generated code but not yet compiled; README carries an explicit construction note until check.sh goes green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-02 17:23:44 +02:00
mrwulf	7d7bc25353	lean-guard: disable core dumps (no more apport popups on capped aborts) ... Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-02 16:23:31 +02:00
mrwulf	75ae21df06	pasta field: foundation + helper + sub/neg proofs against REAL extraction ... - extract.sh: scoped Charon/Aeneas extraction of fields::fp (pow_vartime patched upstream to index loops — semantics-preserving, crate tests pass; sqrt/cmp/sum/random/... opaque, documented) - gen/: real transpiled model; subtle/CtOption hand-modeled (Choice := U8, CtOption := value × is_some), all other externals are axioms outside certificate cones - Proofs/PPallas: Lucas/Pratt primality certificate (reused — it was the one genuine piece of the previous attempt) - Proofs/Denote: Montgomery denotation ⟪a⟫ = feVal a · R⁻¹, Canon invariant - Proofs/HelperSpecs: adc/sbb/mac exact ℕ specs (step-registered) - Proofs/SubNegSpec: sub_spec (general two-case identity covering the t<2P reduction shape) and neg_spec, proven, no axioms Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-02 15:51:57 +02:00